SQL injection vulnerabilities
Untrusted input ends up inside a database query, so an attacker can read, change or delete data the application never meant to expose.
SQL injection in numbers
sbomify tracks 23,565 SQL injection vulnerabilities. Most are found in web application (73%), cms plugin (18%) and server software (6%).
How to fix SQL injection vulnerabilities
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time.
Most exploited SQL injection vulnerabilities
- CVE-2026-72898 Metabase SQL Injection
- CVE-2020-12271 Sophos SFOS SQL Injection
- CVE-2026-76461 Cisco Secure Email Gateway SQL Injection
- CVE-2026-63030 WordPress Core Interpretation Conflict
- CVE-2026-9082 Drupal Core SQL Injection
- CVE-2024-43468 Microsoft Configuration Manager SQL Injection
- CVE-2024-6670 Progress WhatsUp Gold SQL Injection
- CVE-2023-34362 Progress MOVEit Transfer SQL Injection
- CVE-2021-44026 Roundcube Webmail SQL Injection
- CVE-2021-42258 BQE BillQuick Web Suite SQL Injection
- CVE-2021-20028 SonicWall Secure Remote Access (SRA) SQL Injection
- CVE-2021-27101 Accellion FTA SQL Injection
Recently published
- CVE-2026-107081 SQL injection in n/a
- CVE-2026-107082 SQL injection in n/a
- CVE-2026-107083 SQL injection in n/a
- CVE-2026-108776 Apache Kylin: tables/names SparkSQL injection
- CVE-2026-112087 itsourcecode Online Cake Ordering System confirm.php sql injection
- CVE-2026-112088 Dav-ee dairy-management-system add.php mysqli_query sql injection
Other types of vulnerability
- Cross-site scripting54,178
- Memory corruption53,628
- Denial of service36,532
- 35,428
- Missing authorization28,513
- Path traversal19,236
- 16,160
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.